Hey friend, cyberattacks are
growing more sophisticated,
so it's imperative to find ways to
protect your company and your PII.
Your Personally Identifiable
Information. And Azure Lighthouse
uses Azure AD privileged identity
management or PM to support
zero trust provisioning and to
enable secure managed services.
Saif and Megan are here to show
me how this new integration works,
today on Azure Friday.
Hey friends, I'm Scott
Hanselman and its Azure Friday.
I'm here with Megan Olson.
How are you? Hey Scott,
I'm doing well. Thank you.
Thanks for hanging out.
I'm going to learn all about zero
trust provisioning with Azure.
Lighthouse is always a fun topic and
hopefully they'll be a cool demo as well.
Cool thanks Scott.
So customers are migrating to the
cloud and they're kind of trying
to keep up with these constantly
evolving business needs and what
we're really seeing is that they're
engaging multiple service providers
to kind of help them manage and
support their Azure infrastructure.
But with all of these service providers kind
of gaining access to their environment,
it's crucially important that they
maintain zero trust security for all the
users that are accessing their tenants so.
What does that mean?
Zero trust so zero trust is built on three
principles and one of the main principles
of that is least privileged access.
So they always making sure
to use that just enough.
And just in time access that PIN
offers the Azure 80 pin offers I see,
so I only want to give people just
the absolute minimum of what they
need to do their jobs and no more.
Yep, that's correct.
OK,
and then I trust nobody.
So if anyone made it into the building
or made it into my system at every
point I'm checking credentials.
I'm looking at badges and all those
kind of things except digitally.
You got it.
Cool.
So partners have kind of been working
closely with Microsoft to keep up to
date with the latest security best
practices and guidance and kind of
making sure that they're always taking
advantage of the newest services.
To really ensure this zero trust security.
So I have a slide I want to show
you and I'll bring it up right here
so Azure Lighthouse was built as
a solution to kind of help bring
more automation and help scale
the delivery of managed services
with greater visibility security
in governance customers.
Also benefiting from this visibility,
security and governance as they're able
to delegate secure and granular Azure
RBAC that they can then revoke at any time.
So previously Azure Lighthouse was
really designed only so that you
could have standing access with
what are known as permanent roles.
But now with this public preview API
release version you could have just
in time access with eligible roles.
So kind of what this kind of brings.
Is these eligible rose bring?
Is it kind of really allows us,
allows the service provider to then?
At to be able to activate the
role before they actually get
their access is actually granted.
So what?
In addition to that,
what that could also mean,
though,
is that each eligible can also
have a set of approvers who can
then approve the activation request
before the role is actually granted.
So in addition to that,
these eligible rules also offer
the ability for the operator
tafta MFA before gaining this
privileged access, so it really
adds that extra layer of security.
So MFA is a multi factor off,
so the the person is being challenged.
Is that correct?
Yes yes, that's correct.
Yeah each each each operator is
going to have to like multifactor
authenticate with their mobile device
or whatever they're using for that.
And and then they will
gain access to the role.
So all this is available at
no charge to the customer,
so if you're not using Azure
Lighthouse with Azure 80 PIM,
then ask your service provider to
use it and and the only requirement
is at your service provider really
use that each user that to you on
the service provider tenant that
is using Azure 80 PIM has that MSE
5 or Azure AD premium P2 license.
So in this diagram on over here I can
kind of see that I have to some customers.
Tenants and then a managing tenant
and within the managing tenant.
There's kind of three users.
One of them is just kind of using
Azure Lighthouse without Azure 80 PIM,
and so they don't have tag license.
But then the other one.
The other two kind of are using this Azure
80 PIM capability that we're offering,
and one of them is in the approver,
so whenever the eligible
role is activated by user,
one request to be activated,
then the approver then has to approve it.
So all handed off to Seth
now to start demo here.
Show you what this looks like.
Awesome, thank you, Megan and Scott.
It's great to be here on the show.
Very exciting.
Before we get started let me show you
what the onboarding process looks like,
so let me share my screen.
And you should be able to see.
This Jason.
And what this kind of represents
is the ARM template.
The ARM template describes what the
delegation details look like, right?
We have a customer who's delegating
either resource group or a subscription.
And they have to specify what the
delegation contract would look like.
And even though it's a delegation contract,
the customer at any point can revoke that
access that the service provider has.
So before this public preview API that
we've gone public that we just released,
we just had authorizations and
the authorizations described the
standing access that a user group
or service principle would have.
So in this case we have a security
group which just has reader
permission and this is an RBAC role.
Now,
with the kind of PIM integration
that we have,
we introduced eligible authorizations
and with eligible authorizations.
We described the just in time access.
So in this particular case,
this security group has the
network contributor role.
And we can also specify like
a just in time access policy.
What that entails is during
the request process,
right when the service provider is
making that just in time access request.
Do we want them to do 2
factor authentication?
In this case, yes,
through Azure,
do we want to specify approvers
that need to explicitly approve
the just in time access requests?
And you can specify up to 10 approvers
within the service provider tenant.
In this case,
I have a like a PIM approvers group.
The security group that would
have to explicitly approve any
just in time access requests for
the network contributor role.
So now that you kind of had that context
of how the onboarding process looks like,
because essentially this is again the
ARM template that the customer would
deploy on their side once it's deployed,
the service provider would have that access.
It's kind of the convenience of Azure
lighthouse on boarding, and of course
we have other ways of on boarding.
This is just one of the more common ways.
Now if we switch gears I want to show
you what the customer experience.
Looks like on portal,
once they've on boarded.
So let me show you my screen here on Portal.
I've logged in as some customer,
let me go into Azure Lighthouse.
And let me see my service provider offers.
Let me click on delegations.
And I can see that Relic Cloud
managed services.
That's the service provider tenant.
It I I have on boarded to lighthouse and
have delegated my Visual Studio subscription
to the Relic Cloud managed services tenant.
If I click on role assignments I can see
what kind of access I gave Relic left.
I can see that they have standing reader
access and I can see that they have the
contributor access that is of type eligible.
Meaning if they want to get that privilege.
Access they would have to go
through the just in time.
Of access request flow and I'll
show you that in just a second.
Now if for whatever reason I
would like to revoke access,
I would like to revoke the service
providers access to my subscription.
I can do so at anytime by
simply deleting the delegation.
So that's what the customer
experience looks like, right?
The on boarding process,
we wanted to make it as smooth
as possible for the customer.
We also wanted them to have that
assurance that at any point they can
remove a delegation as well as kind
of audit the delegation as need be.
Now let me show you what the service
provider experience looks like on portal.
So if I go to. My portal session here.
I have logged in to the Relic
Cloud managed services tenant.
As staff Keoni think of me as an engineer
within the service provider tenant.
Let me go to Azure Lighthouse.
Let me click manage my customers.
And click delegations.
So you can see that I have.
The I only have the one tenant
showing right which is soft tenant.
I can see the subscription.
And I can see the role assignments
given for this delegation.
The recent no.
The reality is if I'm a service provider, I'm
potentially managing hundreds of customers.
Thousands of resources.
In some cases,
many more.
But we have a very convenient
global subscription filter that
allows me to specify the tenant.
So in this case I have these tenants
that have that are either native like
the role of cloud managed services
that is my service provided tenant,
but then I also have other
tenants that have delegated
their resources to me.
I can also see which subscriptions.
Are delegated to the particular tenant.
So we have let's actually switch
to one of these other offers,
so under the Microsoft customer
tenant we were delegated the
LAMNA healthcare subscription.
And we can see that the view changed.
Now we're just seeing the
Microsoft delegations.
Let me look at this one.
Laminate healthcare.
Let me look at the role assignments.
So if I go to role assignments,
you'll see that we have
the standing reader access.
And the eligible access that we have
is the network contributor rule.
Now, let's say I want to
do some privilege actions.
Let's say maybe I want to service
a request by the customer.
If I click on manage eligible roles,
this launches you two are new to
kind of the new PIM experience,
right?
This is made possible with our kind of
partnership with the Azure AD PM team.
We have an integration which allows
us which allows service providers
to go through this just in time
access flow for any privilege
requests they need to make and you
can see that I have that network
contributor role ready to be activated.
So let's click activate.
It's validating the request,
and while it's validating,
that's when it determines whether or
not two factor authentication is needed.
Now I actually already went through the
two factor authentication process beforehand,
so that wasn't needed.
I can specify the custom activation
start time if I want to delay
the start time of the role.
In this case,
I want it to be as soon as possible.
I only need about an hour to
do the work I need to do.
And let me write my reason.
Just servicing a request.
I'll click activate.
Eventually it says your request
is pending for approval.
Now remember how I showed you that
delegation contract and in it within
the just in time access policy you can
specify approvers and we specified a
security group as the approver so anyone
within that security group can approve.
Let's say it's my boss.
So let me actually show
you what that looks like.
So now I've logged in as the boss.
I've logged in as one of the
users in the approver group.
I would get an email notification
saying hey soft County is requesting
the network contributor role.
Would you like to approve when
I click that link?
It would take me here.
And now I can see.
Yep, Saff County is requesting
network contributor role for the
lamina healthcare subscription.
Why 2 service or request and he only
needs about an hour to do his work.
Looks good to me.
So let me go ahead and.
Approve.
Hit confirm in my job as the
approver is now complete.
Now the user who made the request
would get an email saying your
request has been approved.
You now have the network contributor role.
So now let me switch back to that user.
So I'm back as the user who made the
request for the just in time access.
If I go to active assignments,
eventually I will see the network
contributor role while it's waiting
to complete the approval process.
I can show you another convenient tool
we have, which is the audit logs.
Here you can see what's been going on
within this service provider tenant.
We can see that just within
the last few minutes,
soft county made a request for
the network contributor role.
The there was a approval request sent out.
The request was approved and then we
can see that just recently the Member
Sof Khione got the network contributor role.
So these audit logs kind of give
those give our service providers
yet another tool to create a secure
management experience.
And now if I go back to my rolls.
It should show me that.
The request is.
Approved.
Eventually.
But the kind of main thing that
we want to show here is this.
This whole integration that we
have with the PIM team this whole.
Just in time access that we've
introduced within Azure,
Lighthouse is really giving our
service providers the tools that they
need to secure their customer resources.
Now,
obviously there are transitive benefits
to the customer as well for the
customers they have that assurance
that their resources are secure,
that service providers have only that
have just in time access to do any.
Privileged actions on their resources
and they have just enough access with
being able to specify the RBAC roles.
Now.
It. Seems. With that, the network
contributor role has been activated great.
Now I can see that it's letting me
deactivate it, so I have the role activated.
It tells me what the end time is.
So now as the engineer within the
service provider tenant, I can go on do
whatever privilege actions I need to do.
Once I'm all done, I can either click
deactivate or if I didn't it would
automatically deactivate on its own.
And that's the thing about this
whole new way of thinking.
That's that's so fundamental,
like we're used to people having passwords.
And if you have the password,
you're the admin and you're in charge
of everything and you have full power.
You either have a skeleton
key or you have nothing.
And what I'm hearing, you say,
is that you've got just enough
and just in time access,
so people have the minimum thing that
they need to do to do their job,
and a time window.
And that is a completely new
way of thinking about things.
It's a much more granular way than saying.
Here are the keys on the ring
of all the keys to the Kingdom.
Absolutely Scott and you know,
I would imagine in one of the previous
Azure Friday talks you kind of,
you know,
made the comment about like being
a service provider, right?
If you're a service provider,
you're kind of,
you know,
offering managed services to like
a mom and pop type shop.
It gives them that kind of assurance
right that the service provider
is doing their due diligence
to really create a secure,
secure management experience.
So it's really all about
creating a secure environment,
giving that Peace of Mind to the customer.
So that is pretty much it for the demo.
I'll kind of hand it back to you if you
had any questions for myself or Megan.
Cool, that sounds great.
Let's bring Megan back over and
we'll head towards the end, hey?
Hey thanks scotum.
So yeah if you guys want to check out
this preview here jump on this preview.
Uh,
I'll you can see if your customer
check out RA Comm page where you can
see all these great benefits and if
you're a partner go ahead and check
out our docs of that kind of detail.
How to get started so.
And buy a com you mean azure.com
so the azure.com Lighthouse page
has got great documentation and
details and you can sign up.
Check this out right away.
Yep.
Fantastic,
I am learning all about Azure Adm
and just in time and just amount just
the right amount of access that I
might need today here on Azure Friday.
Hey thanks for watching this
episode of Azure Friday.
Now I need you to like it.
Comment on it, tell your friends, retweet it.
Watch more Azure Friday.